Handbook of Information Security Management
(Publisher: CRC Press LLC)
Author(s): Hal Tipton and Micki Krause, Consulting Editors
ISBN: 0849399475
Publication Date: 01/01/98

Previous | Table of Contents | Next

COMPUTER LARCENY

The theft, burglary, and sale of stolen microcomputers and components are increasing dramatically — a severe problem because the value of the contents of stolen computers often exceeds the value of the hardware taken. The increase in computer larceny is becoming epidemic, in fact, as the market for used computers in which stolen merchandise may be fenced also expands.

It has been suggested that an additional method of protection be used along with standard antitheft devices for securing office equipment. If the user is to be out of the office, microcomputers can be made to run antitheft programs that send frequent signals through modems and telephones to a monitoring station. If the signals stop, an alarm at the monitoring station is set off.

Investigation and prosecution of computer larceny fits well within accepted criminal justice practices, except for proving the size of the loss when a microcomputer worthy only a few hundred dollars is stolen. Evidence of far larger losses (e.g., programs and data) may be needed.

Minicomputers and mainframes have been stolen as well, typically while equipment is being shipped to customers. Existing criminal justice methods can deal with such thefts.

USE OF COMPUTERS FOR CRIMINAL ENTERPRISE

A computer can be used as a tool in a crime for planning, data communications, or control. An existing process can be simulated on a computer, a planned method for carrying out a crime can be modeled, or a crime can be monitored by a computer (i.e., by the abuser) to help guarantee its success.

In one phase of a 1973 insurance fraud in Los Angeles, a computer was used to model the company and determine the effects of the sale of large numbers of insurance policies. The modeling resulted in the creation of 64,000 fake insurance policies in computer-readable form that were then introduced into the real system and subsequently resold as valid policies to reinsuring companies.

The use of a computer for simulation, modeling, and data communications usually requires extensive amounts of computer time and computer program development. Investigation of possible fraudulent use should include a search for significant amounts of computer services used by the suspects. Their recent business activities, as well as the customer lists of locally available commercial time-sharing and service bureau companies, can be investigated. If inappropriate use of the victim’s computer is suspected, logs may show unexplained computer use.

Exhibit 14 lists the potential perpetrators, methods of detection, and kinds of evidence in simulation and modeling techniques.

Exhibit 14. Detection of Simulation and Modeling

SUMMARY

Computer crimes will change rapidly along with the technology. As computing becomes more widespread, maximum losses per case are expected to grow. Ultimately, all business crimes will be computer crimes.

Improved computer controls will make business crime more difficult, dangerous, and complex, however. Computers and workstations impose absolute discipline on information workers, forcing them to perform within set bounds and limiting potential criminal activities. Managers receive improved and more timely information from computers about their businesses and can more readily discern suspicious anomalies indicative of possible wrongdoing.

Although improved response rates from victims, improvements in security, modification of computer use, reactions from the criminal justice community, new laws, and saturation of the news media warning of the problems will cause a reduction of traditional types of crime, newer forms of computer crime will proliferate. Viruses and malicious hacking will eventually be superseded by other forms of computer abuse, including computer larceny, desktop forgery, voice mail and E-mail terrorism and extortion, fax graffiti, phantom computers secretly connected to networks, and repudiation of EDI transactions.

Previous | Table of Contents | Next